Buffer Overflow Vulnerability in C-Kermit FTP Client by OpenKermit

CVE-2026-129123

What is CVE-2026-129123?

The vulnerability in C-Kermit versions prior to 11.1.515 arises from a buffer overflow within the getreply() function in ckcftp.c. This flaw allows malicious FTP servers to exploit client memory by sending excessively long PBSZ or ADAT replies after AUTH TLS, compromising the integrity of client memory. Attackers in control of an FTP server can characterize these long security replies to trigger the overflow, making it possible to introduce attacker-controlled data into the client’s memory space, effectively leading to potential remote code execution or data leakage. It is imperative for users to upgrade to the latest version to safeguard against such threats.

References